[tor-commits] [tor/master] Revert "Get rid of tor_tls_block_renegotiation()."

[nickm at torproject.org]

commit 021ff31ba6c303ebf13e12e691ea74ca4b39a693
Author: Nick Mathewson <nickm at torproject.org>
Date:   Tue Dec 6 19:49:21 2011 -0500

    Revert "Get rid of tor_tls_block_renegotiation()."
    
    This reverts commit 340809dd224b244675496e301d3ba154a6fe68d0.
---
 src/common/tortls.c    |   10 ++++++++++
 src/common/tortls.h    |    1 +
 src/or/connection_or.c |    5 +++++
 3 files changed, 16 insertions(+), 0 deletions(-)

diff --git a/src/common/tortls.c b/src/common/tortls.c
index ddb5ea1..9caf930 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -1572,6 +1572,16 @@ tor_tls_unblock_renegotiation(tor_tls_t *tls)
   }
 }
 
+/** If this version of openssl supports it, turn off renegotiation on
+ * <b>tls</b>.  (Our protocol never requires this for security, but it's nice
+ * to use belt-and-suspenders here.)
+ */
+void
+tor_tls_block_renegotiation(tor_tls_t *tls)
+{
+  tls->ssl->s3->flags &= ~SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
+}
+
 void
 tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls)
 {
diff --git a/src/common/tortls.h b/src/common/tortls.h
index e558df7..673f18d 100644
--- a/src/common/tortls.h
+++ b/src/common/tortls.h
@@ -77,6 +77,7 @@ int tor_tls_handshake(tor_tls_t *tls);
 int tor_tls_finish_handshake(tor_tls_t *tls);
 int tor_tls_renegotiate(tor_tls_t *tls);
 void tor_tls_unblock_renegotiation(tor_tls_t *tls);
+void tor_tls_block_renegotiation(tor_tls_t *tls);
 void tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls);
 int tor_tls_shutdown(tor_tls_t *tls);
 int tor_tls_get_pending_bytes(tor_tls_t *tls);
diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index 992db9a..cbe678d 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -1149,6 +1149,10 @@ connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn)
   or_connection_t *conn = _conn;
   (void)tls;
 
+  /* Don't invoke this again. */
+  tor_tls_set_renegotiate_callback(tls, NULL, NULL);
+  tor_tls_block_renegotiation(tls);
+
   if (connection_tls_finish_handshake(conn) < 0) {
     /* XXXX_TLS double-check that it's ok to do this from inside read. */
     /* XXXX_TLS double-check that this verifies certificates. */
@@ -1537,6 +1541,7 @@ connection_tls_finish_handshake(or_connection_t *conn)
       connection_or_init_conn_from_address(conn, &conn->_base.addr,
                                            conn->_base.port, digest_rcvd, 0);
     }
+    tor_tls_block_renegotiation(conn->tls);
     return connection_or_set_state_open(conn);
   } else {
     conn->_base.state = OR_CONN_STATE_OR_HANDSHAKING_V2;